Network traffic is transmitted across a network, such as the Internet, from a sending system (e.g., a computer system) to a receiving system (e.g., a computer system) via a network interface card (NIC). The NIC is a piece of hardware found in a typical computer system that includes functionality to send and receive network traffic. Typically, network traffic is transmitted in the form of packets, where each packet includes a header and a payload. The header contains information regarding the source address, destination address, size, transport protocol used to transmit the packet, and various other identification information associated with the packet. The payload contains the actual data to be transmitted from the network to the receiving system.
Each of the packets sent between the sending system and receiving system is typically associated with a connection. The connection ensures that packets from a given process on the sending system reach the appropriate process on the receiving system. Packets received by the receiving system (via a NIC associated with the receiving system) are analyzed by a classifier to determine the connection associated with the packet.
With the rising popularity of offering critical services (e.g., web services, applications, identity services, mail services, etc.) on the Internet, attacks on the receiving system that offer such critical services have become relatively common. A common attack is a denial of service (DOS) attack where a sending system bombards a receiving system (i.e., host) with a large number of packets causing excessive amounts of endpoint, and possibly transit, network bandwidth (or resources) to be consumed. Such attacks are commonly referred to as packet flooding attacks.
The Internet is entirely composed of limited resources. Such limited resources as bandwidth, processing power, and storage capacities are all common targets for DOS attacks designed to consume enough of a host's available resources to cause some level of service disruption. One reaction to DOS attacks is to overprovision a system to handle excess loads that may be generated by the attack. However, a limit exists to the amount of limited resources that can be allocated to a system, both in terms of availability and cost. Accordingly, most of the service providers with any level of critical services on the Internet deploy various kinds of intrusion detection systems (IDS) to assist in defending against DOS attacks.
The primary responsibility of the IDS is to identify the attacking traffic based on traffic patterns and knowledge databases (i.e., databases maintaining historical data useful in recognizing or predicting patterns consistent with DOS attacks). IDS's continually become more sophisticated by using such techniques as rate limiting, packet filtering, and tweaking software parameters to help limit the impact of DOS attacks. As a result, the IDS can successfully identify the attacking network traffic and often the originating IP address(es). In most cases, the only defense is a reactive one where the source or sources of an ongoing attack are identified and prevented from continuing the attack. Nevertheless, the impacted resources and systems still suffer from the DOS attack and human intervention is required to take action based on a report generated by the IDS to potential fix the issues associated with the attack.
Recently, the use of source IP address spoofing during DOS attacks and the advent of distributed attack methods and tools have provided a constant challenge in the area of DOS attack prevention.